Can a user or agent turn off their own MFA while enforcement is on?

No. On My Profile, the Multifactor Authentication switch is locked on and shows "Required by your administrator - cannot be turned off". Admins also can't switch MFA off for an enrolled user from the agent or contact edit screens while enforcement is on.